Dockerfile.client

FROM alpine:latest

# Install dependencies including iptables for network restrictions
RUN apk add --no-cache ca-certificates wget iptables

# Install chisel
RUN wget -q https://github.com/jpillora/chisel/releases/download/v1.11.3/chisel_1.11.3_linux_amd64.gz && \
    gunzip chisel_1.11.3_linux_amd64.gz && \
    mv chisel_1.11.3_linux_amd64 /usr/local/bin/chisel && \
    chmod +x /usr/local/bin/chisel

# Create user
RUN addgroup -g 1000 broker && \
    adduser -D -u 1000 -G broker broker

# Copy entrypoint
COPY client-entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

# Note: Run with --cap-add=NET_ADMIN for network restrictions to work
LABEL description="ZeroPath Broker Client - Reverse proxy with access controls"
LABEL version="1.0"
LABEL vendor="ZeroPath Corp."
LABEL website="zeropath.com"

# Switch to non-root user for security
# Note: iptables rules require NET_ADMIN capability
USER broker

ENTRYPOINT ["/entrypoint.sh"]